CLAIMS 



What is claimed is: 

1 . (Previously Amended) A method for automatically analyzing network 
events, comprising: 

generating a matrix that illustrates distance relationships between a plurality of 
network events and a focal event from the plurality of network events or that 
illustrates distance relationships between a plurality of network objects and a focal 
object from the plurality of network objects; and 

automatically analyzing the matrix by evaluating at least one event vector. 

2. (Original) The method of claim 1, wherein the matrix is based in part on a 
resource topology or an event topology. 

3. (Original) The method of claim 1, wherein the matrix illustrates 
connectivity relationships among the plurality of network objects. 

4. (Original) The method of claim 1, wherein the matrix illustrates dependency 
relationships among the plurality of network objects. 

5. (Original) The method of claim 1, wherein the matrix illustrates time 
relationships between the plurality of network events and the focal event. 

6. (Original) The method of claim 1, wherein the matrix illustrates a relative 
distance among the plurality of network events or the plurality of network objects. 

7. (Original) The method of claim 1, further comprising: 

filtering the plurality of network events before generating the matrix. 
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8. (Original) The method of claim 1, further comprising: 

applying event- specific or object- specific rules or policies to a result of the analysis of 
the matrix. 

9. (Original) The method of claim 1, wherein the matrix is populated with 
identifiers of the plurality of network objects or identifiers of the plurality of network 
events. 

10. (Original) The method of claim 1, wherein the at least one event vector is a 
set of etwork events from the plurality of network events along a path of related 
network objects from he plurality of network objects. 

11. (Original) The method of claim 1, wherein the automatic analyzing 
comprises a ympathetic event reduction, which comprises: 

identifying at least one related event from the plurality of network events; 

correlating the at least one related event to the focal event; and 

hiding at least one redundant sympathetic event from the plurality of network 

events. 

12. (Original) The method of claim 1, wherein the automatic analyzing 
comprises a dependency analysis, which comprises locating common dependencies 
among the plurality of network objects. 

13. (Original) The method of claim 1, wherein the automatic analyzing 
comprises an impact analysis, which comprises determining which of the plurality of 
network objects are affected by the focal event. 

14. (Original) The method of claim 1, wherein the automatic analyzing 
comprises a predictive analysis, which comprises determining which of the plurality 
of network objects would be affected by a hypothetical focal event. 
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1 5. (Original) The method of claim 1, wherein the automatic analyzing 
comprises a root cause analysis, which comprises identifying and prioritizing at least 
one suspected root event from the plurality of network events as a potential root cause 
of the focal event. 

16 (Original) The method of claim 15, wherein the identifying and prioritizing 
the at least one suspected root event comprises: 

identifying at least one leaf-node event from the plurality of network events; 

ranking the at least one leaf-node event according to ranking factors; and 

suppressing each of the plurality of network events that are in the at least one 
event vector and that are not the focal event or the at least one leaf-note event, 

wherein the ranking factors comprise the angle of the at least one event vector, 
a time dispersion along the at least one event vector, and a consistency of event types 
along the at least one event vector. 

17. (Original) The method of claim 1, further comprising: 

displaying the focal event, at least one other event of the plurality of network 
events, and the relationships between the focal event and the at least one other event 
on a user interface, 

wherein each of the displayed plurality of network events is displayed as one 
of a plurality of network event icons in one of a plurality of colors to indicate event 
severity, and 

wherein each of the displayed plurality of network event icons is displayed 
with a clock-like arc in one of two colors to represent a time relationship as compared 
to the focal event. 

18. (Original) The method of claim 17, wherein the displaying is static or 
dynamic. 
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19. (Original) The method of claim 17, wherein only the focal event and at 
least one leaf-node event from the plurality of network events are displayed. 

20. (Original) The method of claim 17, wherein the relationships are 
illustrated with a plurality of lines connecting at least two of the displayed plurality of 
network events. 

21 . (Original) The method of claim 20, wherein the plurality of lines vary in 
thickness and composition to illustrate rank. 

2 2 . (Previously Amended) A machine -readable medium that provides 
instructions for automatically analyzing network events, which, when executed by a 
machine, cause the machine to perform operations comprising: 

generating a matrix that illustrates distance relationships between a plurality of 
network events and a focal event from the plurality of network events or that 
illustrates distance relationships between a plurality of network objects and a focal 
object from the plurality of network objects; and 

automatically analyzing the matrix by evaluating at least one event vector. 

23. (Original) The machine-readable medium of claim 22, wherein the matrix is 
based in part on a resource topology or an event topology 

24. (Original) The machine-readable medium of claim 22, wherein the matrix 
illustrates connectivity relationships among the plurality of network objects. 

25. (Original) The machine-readable medium of claim 22, wherein the matrix 
illustrates dependency relationships among the plurality of network objects. 

26. (Original) The machine-readable medium of claim 22, wherein the matrix 
illustrates-time relationships between the plurality of network events and the focal event. 
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27. (Original) The machine-readable medium of claim 22, wherein the matrix 
illustrates a relative distance among the plurality of network events or the plurality of 
network objects. 

28. (Original) The machine-readable medium of claim 22, wherein the 
instructions cause the machine to perform operations further comprising: 

filtering the plurality of network events before generating the matrix. 

29. (Original) The machine-readable medium of claim 22, wherein the 
instructions cause the machine to perform operations further comprising: 

applying event- specific or object-specific rules or policies to a result of the analysis of the 
matrix. 

30. (Original) The machine-readable medium of claim 22, wherein the matrix is 
populated with identifiers of the plurality of network objects or identifiers of the plurality 
of network events. 

3 1 . (Original) The machine readable medium of claim 22, wherein the at least 
one event vector is a set of network events from the plurality of network events along 
a path of related network objects from the plurality of network objects. 

32. (Original) The machine-readable medium of claim 22, wherein the 
automatic analyzing comprises a sympathetic event reduction, which causes the 
machine to perform operations comprising: 

identifying at least one related event from the plurality of network events; 

correlating the at least one related event to the focal event; and 

hiding at least one redundant sympathetic event from the plurality of network 

events. 
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33. (Original) The machine-readable medium of claim 22, wherein the 
automatic analyzing comprises a dependency analysis, which comprises locating 
common dependencies among the plurality of network objects. 

34. (Original) The machine-readable medium of claim 22, wherein the 
automatic analyzing comprises an impact analysis, which comprises determining 
which of the plurality of network objects are affected by the focal event. 

35. (Original) The machine-readable medium of claim 22, wherein the 
automatic analyzing comprises a predictive analysis, which comprises determining 
which of the plurality of network objects would be affected by a hypothetical focal 
event. 

36. (Original) The machine-readable medium of claim 22, wherein the 
automatic analyzing comprises a root cause analysis, which comprises identifying and 
prioritizing at least one suspected root event from the plurality of network events as a 
potential root cause of the focal event. 

37. (Original) The machine-readable medium of claim 36, wherein the 
identifying and prioritizing the at least one suspected root event causes the machine to 
perform operations comprising: 

identifying at least one leaf-node event from the plurality of network events; 
ranking the at least one leaf-node event according to ranking factors; and 
suppressing each of the plurality of network events that are in the at least one 
event vector and that are not the focal event or the at least one leaf-note event, 
wherein the ranking factors comprise the angle of the at least one event vector, a time 
dispersion along the at least one event vector, and a consistency of event types along 
the at least one event vector. 
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38. (Original) The machine-readable medium of claim 22, wherein the 
instructions cause the machine to perform operations krther comprising: 

displaying the focal event, at least one other event of the plurality of network 
events, and the relationships between the focal event and the at least one other event 
on a user interface, 

wherein each of the displayed plurality of network events is displayed as one 
of a plurality of network event icons in one of a plurality of colors to indicate event 
severity, and 

wherein each of the displayed plurality of network event icons is displayed with a 
clocklike arc in one of two colors to represent a time relationship as compared to the 
focal event. 

39. (Original) The machine-readable medium of claim 38, wherein the 
displaying is static or dynamic. 

40. (Original) The machine-readable medium of claim 38, wherein only the 
focal event: and at least one leaf-node event from the plurality of network events are 
displayed. 

41. (Original) The machine-readable medium of claim 3 8, wherein the 
relationships are illustrated with a plurality of lines connecting at least two of the 
plurality of network events. 

42. (Original) The machine-readable medium of claim 4 1, wherein the 
plurality of lines vary in thickness and composition to illustrate rank. 
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